| From 023392c0276f843384efd5eb6fc66d8bdc6a2772 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 7 Jul 2018 17:52:47 +0000 |
| Subject: kernfs: Fix range checks in kernfs_get_target_path |
| |
| From: Bernd Edlinger <bernd.edlinger@hotmail.de> |
| |
| [ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ] |
| |
| The terminating NUL byte is only there because the buffer is |
| allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the |
| range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the |
| returned string may not be zero-terminated if it is exactly |
| PATH_MAX characters long. Furthermore also the initial loop |
| may theoretically exceed PATH_MAX and cause a fault. |
| |
| Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de> |
| Acked-by: Tejun Heo <tj@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/kernfs/symlink.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c |
| index 305b220af45d3..162f43b80c84c 100644 |
| --- a/fs/kernfs/symlink.c |
| +++ b/fs/kernfs/symlink.c |
| @@ -72,6 +72,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent, |
| if (base == kn) |
| break; |
| |
| + if ((s - path) + 3 >= PATH_MAX) |
| + return -ENAMETOOLONG; |
| + |
| strcpy(s, "../"); |
| s += 3; |
| base = base->parent; |
| @@ -88,7 +91,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent, |
| if (len < 2) |
| return -EINVAL; |
| len--; |
| - if ((s - path) + len > PATH_MAX) |
| + if ((s - path) + len >= PATH_MAX) |
| return -ENAMETOOLONG; |
| |
| /* reverse fillup of target string from target to base */ |
| -- |
| 2.20.1 |
| |
